4 ms·

How are all those civilian agencies using GitHub without a FISMA or FedRAMP approval (or does GitHub have one and just not advertise it)? I see at least NASA o

by count 13y ago

How are all those civilian agencies using GitHub without a FISMA or FedRAMP approval (or does GitHub have one and just not advertise it)? I see at least NASA on there (who just got in trouble with their IG for improper use of un-accredited cloud services). Or does this include GitHub Enterprise users?

mpyne 13y ago
As far as I can tell the FISMA certification is done by the agency itself, in accordance with the guidelines laid out by NIST and OMB directives. As long as the confidentiality, integrity and availability requirements are all "low" I don't see why the agency CIO couldn't simply deem GitHub as an acceptable information system for the purposes of posting files that are already cleared for unlimited public release.
- niels_olson 13y ago
  Thanks for that. Ironically, I'm trying to collaborate with some folks, I'm DoD, and can't access the github site. And now, with the shutdown, I can't access NIST either (they are apparently closed for business except for a couple critical roles).
  - sailfast 13y ago
    I'd recommend reaching out to @BenBalter to talk through using this for DoD. As for FISMA and compliance I believe GitHub has a government-ready ToS that could be applied - but you'd probably want to get an official go-ahead to use it to host code, and I'd still think hard about using GitHub vs. a git service behind the firewall depending on what you're building.
  - count 13y ago
    Archive.org had much of the NIST content mirrored, if you just need specific pub references/etc. (and not trying to work with the people specifically). Getting GitHub for DoD would be great...
- count 13y ago
  That 'deeming' is the ATO / certification act. That's what I was asking: has any federal CIO or AO actually certified and granted an ATO to GitHub? This would be fantastic news, but I doubt it. Also, Github (the SaaS) is a 'cloud' service, so it would need FedRAMP approval (which could be done via the agency ATO if they desired) as well, but it wasn't on the FedRAMP site last I checked.

by count 13y ago

mpyne 13y ago

As far as I can tell the FISMA certification is done by the agency itself, in accordance with the guidelines laid out by NIST and OMB directives. As long as the confidentiality, integrity and availability requirements are all "low" I don't see why the agency CIO couldn't simply deem GitHub as an acceptable information system for the purposes of posting files that are already cleared for unlimited public release.

niels_olson 13y ago
Thanks for that. Ironically, I'm trying to collaborate with some folks, I'm DoD, and can't access the github site. And now, with the shutdown, I can't access NIST either (they are apparently closed for business except for a couple critical roles).
- sailfast 13y ago
  I'd recommend reaching out to @BenBalter to talk through using this for DoD. As for FISMA and compliance I believe GitHub has a government-ready ToS that could be applied - but you'd probably want to get an official go-ahead to use it to host code, and I'd still think hard about using GitHub vs. a git service behind the firewall depending on what you're building.
- count 13y ago
  Archive.org had much of the NIST content mirrored, if you just need specific pub references/etc. (and not trying to work with the people specifically). Getting GitHub for DoD would be great...
count 13y ago
That 'deeming' is the ATO / certification act. That's what I was asking: has any federal CIO or AO actually certified and granted an ATO to GitHub? This would be fantastic news, but I doubt it. Also, Github (the SaaS) is a 'cloud' service, so it would need FedRAMP approval (which could be done via the agency ATO if they desired) as well, but it wasn't on the FedRAMP site last I checked.